shortcutxl 0.3.89 → 0.3.90

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (53) hide show
  1. package/BINARY-INVENTORY.json +12 -12
  2. package/CHANGELOG.md +2 -1
  3. package/dist/app/local/tools/execute-code/approval-payload.d.ts +5 -1
  4. package/dist/app/local/tools/execute-code/executor.d.ts +4 -15
  5. package/dist/app/local/tools/execute-code/executor.js +56 -146
  6. package/dist/app/local/tools/execute-code/observability.js +0 -20
  7. package/dist/app/local/tools/execute-code/tool.js +0 -17
  8. package/dist/app/local/tools/execute-code/write-analyzer.js +2 -0
  9. package/dist/app/local/tools/take-screenshot/com-screenshot.js +8 -1
  10. package/dist/app/local/tools/take-screenshot/mog-screenshot.d.ts +0 -1
  11. package/dist/app/local/tools/take-screenshot/mog-screenshot.js +10 -17
  12. package/dist/app/modes/manage/prompt.js +1 -1
  13. package/dist/app/providers/model-resolver.js +1 -0
  14. package/dist/app/session/session-models.js +1 -1
  15. package/dist/app/tools/take-screenshot.d.ts +3 -0
  16. package/dist/app/tools/take-screenshot.js +5 -2
  17. package/dist/cli.js +129 -223
  18. package/dist/contracts/agent-snapshot.d.ts +14 -0
  19. package/dist/contracts/agent-snapshot.js +6 -0
  20. package/dist/core/agent-snapshot-builder.js +6 -2
  21. package/dist/core/prompts/take-screenshot.d.ts +1 -1
  22. package/dist/core/prompts/take-screenshot.js +1 -0
  23. package/dist/embedded-agent/compose.js +5 -4
  24. package/dist/embedded-agent/host-tools/take-screenshot/contract.d.ts +1 -1
  25. package/dist/embedded-agent/model-registry.d.ts +1 -0
  26. package/dist/embedded-agent/model-registry.js +1 -0
  27. package/dist/main.js +5 -3
  28. package/dist/model-ids.d.ts +4 -0
  29. package/dist/model-ids.js +10 -1
  30. package/dist/shortcut-model-catalog.js +12 -6
  31. package/dist/subagent-model-policy.js +1 -0
  32. package/native-app/main/index.js +2 -2
  33. package/native-app/package.json +1 -1
  34. package/native-app/renderer/assets/{index-SuRESuDS.js → index-Dep1w85F.js} +3 -3
  35. package/native-app/renderer/index.html +1 -1
  36. package/package.json +1 -1
  37. package/user-docs/dist/index.html +12 -24
  38. package/user-docs/security.md +4 -9
  39. package/xll/modules/shortcut_xl/_exec_entry.py +19 -4
  40. package/xll/modules/shortcut_xl/_exec_sandbox.py +2 -2
  41. package/xll/modules/shortcut_xl/_log.py +9 -2
  42. package/xll/modules/shortcut_xl/_threading.py +1 -1
  43. package/xll/python/Lib/site-packages/httpx-0.28.1.dist-info/RECORD +1 -1
  44. package/xll/python/Lib/site-packages/idna-3.18.dist-info/RECORD +1 -1
  45. package/xll/python/Lib/site-packages/pip-26.2.dist-info/RECORD +3 -3
  46. package/xll/python/Lib/site-packages/pywin32-311.dist-info/RECORD +2 -2
  47. package/xll/python/Scripts/httpx.exe +0 -0
  48. package/xll/python/Scripts/idna.exe +0 -0
  49. package/xll/python/Scripts/pip.exe +0 -0
  50. package/xll/python/Scripts/pip3.13.exe +0 -0
  51. package/xll/python/Scripts/pip3.exe +0 -0
  52. package/xll/python/Scripts/pywin32_postinstall.exe +0 -0
  53. package/xll/python/Scripts/pywin32_testall.exe +0 -0
@@ -1,14 +1,14 @@
1
1
  {
2
2
  "schemaVersion": 1,
3
- "generatedAt": "2026-09-02T01:14:28.575Z",
3
+ "generatedAt": "2026-09-02T05:35:16.912Z",
4
4
  "package": "shortcutxl",
5
5
  "build": {
6
6
  "builder": "github-actions",
7
7
  "repository": "lyfegame/shortcut",
8
- "sourceRef": "refs/heads/codex/cli-daily-credit-usage",
9
- "sourceCommit": "79a4adfc21dce36c575744cbbf07df842928b610",
10
- "workflowRef": "lyfegame/shortcut/.github/workflows/release-shortcut-cli-npm-package.yml@refs/heads/codex/cli-daily-credit-usage",
11
- "runId": "33578448535",
8
+ "sourceRef": "refs/heads/codex/excel-preexecution-approval",
9
+ "sourceCommit": "2520273120cc4b4024d877790eacf6f41fefdd7c",
10
+ "workflowRef": "lyfegame/shortcut/.github/workflows/release-shortcut-cli-npm-package.yml@refs/heads/codex/excel-preexecution-approval",
11
+ "runId": "33595155271",
12
12
  "runnerOs": "Windows",
13
13
  "runnerImage": "win25-vs2026",
14
14
  "runnerImageVersion": "20260824.214.3"
@@ -550,7 +550,7 @@
550
550
  },
551
551
  {
552
552
  "path": "xll/python/Scripts/httpx.exe",
553
- "sha256": "56ecd26f514b1582761c3403f4938d112adc5f033a63d4bc945181079ca82ead",
553
+ "sha256": "a7f8d80085b1d17fdf993cd7246d55f05726e3eb624859a8ba3b69b76368bd4c",
554
554
  "source": "httpx console launcher installed into embedded Python",
555
555
  "version": "see packaged httpx distribution",
556
556
  "builtBy": "third-party",
@@ -558,7 +558,7 @@
558
558
  },
559
559
  {
560
560
  "path": "xll/python/Scripts/idna.exe",
561
- "sha256": "ffda0108e10dc93a09f57419aac0a52d85871bb787308bf946ac851cb11f703a",
561
+ "sha256": "75e2f1c65f561084f603823794d6ad5877ef0a5b1ef0b1fffff096603479642a",
562
562
  "source": "Python package console launcher installed into embedded Python",
563
563
  "version": "see owning Python package metadata in site-packages",
564
564
  "builtBy": "third-party",
@@ -566,7 +566,7 @@
566
566
  },
567
567
  {
568
568
  "path": "xll/python/Scripts/pip.exe",
569
- "sha256": "ce0f86f7cf5cc2882a4821943d3af21f7c41218ff43e7a1f62b18f185aefde97",
569
+ "sha256": "f68ea8e144f74e0f9748750a5fc21b73e11d63486c905730aa474e28f3bab8e7",
570
570
  "source": "pip console launcher installed into embedded Python",
571
571
  "version": "see packaged pip distribution",
572
572
  "builtBy": "third-party",
@@ -574,7 +574,7 @@
574
574
  },
575
575
  {
576
576
  "path": "xll/python/Scripts/pip3.13.exe",
577
- "sha256": "ce0f86f7cf5cc2882a4821943d3af21f7c41218ff43e7a1f62b18f185aefde97",
577
+ "sha256": "f68ea8e144f74e0f9748750a5fc21b73e11d63486c905730aa474e28f3bab8e7",
578
578
  "source": "pip console launcher installed into embedded Python",
579
579
  "version": "see packaged pip distribution",
580
580
  "builtBy": "third-party",
@@ -582,7 +582,7 @@
582
582
  },
583
583
  {
584
584
  "path": "xll/python/Scripts/pip3.exe",
585
- "sha256": "ce0f86f7cf5cc2882a4821943d3af21f7c41218ff43e7a1f62b18f185aefde97",
585
+ "sha256": "f68ea8e144f74e0f9748750a5fc21b73e11d63486c905730aa474e28f3bab8e7",
586
586
  "source": "pip console launcher installed into embedded Python",
587
587
  "version": "see packaged pip distribution",
588
588
  "builtBy": "third-party",
@@ -590,7 +590,7 @@
590
590
  },
591
591
  {
592
592
  "path": "xll/python/Scripts/pywin32_postinstall.exe",
593
- "sha256": "ff04c09d3e15a07d9a4006748c92e511f7e5c5abb2c78b68d7233e8f3ff19630",
593
+ "sha256": "3d5142d3d301b5b22ec9f9ba2d29c9f8a4a73bad069389a73dafbd61e2b37696",
594
594
  "source": "Python package console launcher installed into embedded Python",
595
595
  "version": "see owning Python package metadata in site-packages",
596
596
  "builtBy": "third-party",
@@ -598,7 +598,7 @@
598
598
  },
599
599
  {
600
600
  "path": "xll/python/Scripts/pywin32_testall.exe",
601
- "sha256": "c0641e3d6816baddcabb155f66ffb5de7c378b8257b95ad16f0a45e26184b879",
601
+ "sha256": "494be3de764340437d1fb12aaaefaf8f47c5a482f14834da3a17b080c71d6e16",
602
602
  "source": "Python package console launcher installed into embedded Python",
603
603
  "version": "see owning Python package metadata in site-packages",
604
604
  "builtBy": "third-party",
package/CHANGELOG.md CHANGED
@@ -1,8 +1,9 @@
1
1
  # Changelog
2
2
 
3
- ## [0.3.89]
3
+ ## [0.3.90]
4
4
 
5
5
  - **Skill Forge** - A recursive self-improvement loop for skills. Create or improve personal skills by giving Skill Forge tasks and a grading bar to train, evaluate, and refine against.
6
+ - **Safer, more reliable Excel changes** - Shortcut now asks for approval before making workbook changes and allows longer operations to finish without timing out.
6
7
  - **Credit usage at a glance** - See today's personal credit usage for non-teams users.
7
8
 
8
9
  ## [0.3.88]
@@ -6,6 +6,10 @@ export interface ExcelDiffApprovalPayload {
6
6
  kind: 'diff';
7
7
  description: string;
8
8
  }
9
+ export interface ExcelWriteApprovalPayload {
10
+ kind: 'write';
11
+ description: string;
12
+ }
9
13
  export interface OfficeDangerousApprovalPayload {
10
14
  kind: 'dangerous';
11
15
  description: string;
@@ -13,5 +17,5 @@ export interface OfficeDangerousApprovalPayload {
13
17
  summary: string;
14
18
  operations: OfficeApprovalOperation[];
15
19
  }
16
- export type OfficeApprovalPayload = ExcelDiffApprovalPayload | OfficeDangerousApprovalPayload;
20
+ export type OfficeApprovalPayload = ExcelDiffApprovalPayload | ExcelWriteApprovalPayload | OfficeDangerousApprovalPayload;
17
21
  //# sourceMappingURL=approval-payload.d.ts.map
@@ -2,9 +2,9 @@
2
2
  * COM execute_code executor — local XLL-backed execution lifecycle.
3
3
  *
4
4
  * Owns the COM-specific execution flow:
5
- * 1. Send code to the local XLL via xllFetch
6
- * 2. Parse and validate the response
7
- * 3. Run the approval / revert / cleanup flow
5
+ * 1. Classify code and request write approval before execution
6
+ * 2. Send approved code to the local XLL via xllFetch
7
+ * 3. Parse and validate the response
8
8
  *
9
9
  * Used by:
10
10
  * - `createExcelExecTool()` (COM ToolDefinition wrapper)
@@ -23,7 +23,7 @@ export interface ComExecResult {
23
23
  cfTxId?: string;
24
24
  editMode?: boolean;
25
25
  }
26
- export type ApprovalOutcome = 'accepted' | 'approval-unavailable' | 'failed' | 'reverted' | 'revert-failed' | 'rejected';
26
+ export type ApprovalOutcome = 'accepted' | 'approval-unavailable' | 'failed' | 'rejected';
27
27
  export interface LocalExecResult {
28
28
  result: ComExecResult;
29
29
  outcome: ApprovalOutcome;
@@ -33,19 +33,9 @@ export interface ExcelExecApprovalObservability {
33
33
  onRequested?: (request: ApprovalRequest<OfficeApprovalPayload>) => void;
34
34
  onAccepted?: (request: ApprovalRequest<OfficeApprovalPayload>, choice: ApprovalChoice) => void;
35
35
  onRejected?: (request: ApprovalRequest<OfficeApprovalPayload>) => void;
36
- onReverted?: (request: ApprovalRequest<OfficeApprovalPayload>) => void;
37
- onRevertFailed?: (request: ApprovalRequest<OfficeApprovalPayload>) => void;
38
- }
39
- interface ApprovalResolution {
40
- outcome: ApprovalOutcome;
41
- approvalSummaries?: string[];
42
36
  }
43
37
  /** Validate that a parsed JSON value has the COM execute result shape. */
44
38
  export declare function isComExecResult(v: unknown): v is ComExecResult;
45
- /**
46
- * Resolve approval for cell changes: show UI if needed, then revert or cleanup.
47
- */
48
- export declare function resolveApproval(result: ComExecResult, approval: ApprovalGate<OfficeApprovalPayload> | undefined, postControl: (body: object) => Promise<Response>, ctx: ExtensionContext, description?: string, observability?: ExcelExecApprovalObservability, priorApprovalSummaries?: string[]): Promise<ApprovalResolution>;
49
39
  /**
50
40
  * Execute code against the local XLL and run approval.
51
41
  *
@@ -60,5 +50,4 @@ export declare function executeComLocally(excelTarget: ExcelHostEndpoint, code:
60
50
  observability?: ExcelExecApprovalObservability;
61
51
  editModeTiming?: Partial<EditModeRetryTiming>;
62
52
  }): Promise<LocalExecResult>;
63
- export {};
64
53
  //# sourceMappingURL=executor.d.ts.map
@@ -2,14 +2,13 @@
2
2
  * COM execute_code executor — local XLL-backed execution lifecycle.
3
3
  *
4
4
  * Owns the COM-specific execution flow:
5
- * 1. Send code to the local XLL via xllFetch
6
- * 2. Parse and validate the response
7
- * 3. Run the approval / revert / cleanup flow
5
+ * 1. Classify code and request write approval before execution
6
+ * 2. Send approved code to the local XLL via xllFetch
7
+ * 3. Parse and validate the response
8
8
  *
9
9
  * Used by:
10
10
  * - `createExcelExecTool()` (COM ToolDefinition wrapper)
11
11
  */
12
- import { log } from '../../../../shared/logging/agent-log.js';
13
12
  import { INTERACTIVE_APPROVAL_UNAVAILABLE_MESSAGE } from '../../../approvals/approval-errors.js';
14
13
  import { APPROVAL } from '../../../approvals/types.js';
15
14
  import { getApprovalSurface, resolveApprovalExecutionDecision } from '../../../permissions/approval-surface.js';
@@ -31,13 +30,6 @@ export function isComExecResult(v) {
31
30
  (r.error === undefined || typeof r.error === 'string') &&
32
31
  (r.editMode === undefined || typeof r.editMode === 'boolean'));
33
32
  }
34
- // ---------------------------------------------------------------------------
35
- // Control constants
36
- // ---------------------------------------------------------------------------
37
- const CONTROL = {
38
- REVERT: 'revert',
39
- CLEANUP: 'cleanup'
40
- };
41
33
  function describeExcelApprovalChoice(choice) {
42
34
  switch (choice) {
43
35
  case APPROVAL.ACCEPT:
@@ -97,95 +89,41 @@ async function requestAlwaysConfirmApproval(approval, ctx, description, dangerou
97
89
  return { choice, unavailable: false };
98
90
  }
99
91
  // ---------------------------------------------------------------------------
100
- // Approval resolution
92
+ // Pre-execution write approval
101
93
  // ---------------------------------------------------------------------------
102
- /**
103
- * Resolve approval for cell changes: show UI if needed, then revert or cleanup.
104
- */
105
- export async function resolveApproval(result, approval, postControl, ctx, description, observability, priorApprovalSummaries) {
106
- const { diff, cfTxId } = result;
107
- let approvalSummaries = priorApprovalSummaries;
108
- if (diff) {
109
- const request = {
110
- kind: 'execute_code',
111
- title: 'Review Excel changes',
112
- choices: [APPROVAL.ACCEPT, APPROVAL.ACCEPT_ALL, APPROVAL.REJECT],
113
- payload: {
114
- kind: 'diff',
115
- description: description?.trim() || 'Updating Excel'
116
- }
117
- };
118
- const decision = resolveApprovalExecutionDecision({
119
- surface: getApprovalSurface(ctx),
120
- gateAvailable: approval !== undefined,
121
- isSafe: false,
122
- isAutoApproved: approval?.isAutoApproved() ?? false,
123
- alwaysRequireExplicitApproval: false,
124
- allowHeadlessApproval: ctx.permissionPolicy?.office.allowHeadlessApproval ?? false
125
- });
126
- if (decision === 'prompt') {
127
- if (!approval) {
128
- observability?.onRejected?.(request);
129
- try {
130
- await postControl({ control: CONTROL.REVERT, cfTxId });
131
- observability?.onReverted?.(request);
132
- return { outcome: 'reverted' };
133
- }
134
- catch {
135
- if (cfTxId != null) {
136
- await postControl({ control: CONTROL.CLEANUP, cfTxId }).catch(() => { });
137
- }
138
- observability?.onRevertFailed?.(request);
139
- return { outcome: 'revert-failed' };
140
- }
141
- }
142
- observability?.onRequested?.(request);
143
- const choice = await approval.requestApproval(request, ctx);
144
- if (choice === APPROVAL.REJECT || choice === undefined) {
145
- observability?.onRejected?.(request);
146
- try {
147
- await postControl({ control: CONTROL.REVERT, cfTxId });
148
- observability?.onReverted?.(request);
149
- return { outcome: 'rejected' };
150
- }
151
- catch {
152
- if (cfTxId != null) {
153
- await postControl({ control: CONTROL.CLEANUP, cfTxId }).catch(() => { });
154
- }
155
- observability?.onRevertFailed?.(request);
156
- return { outcome: 'revert-failed' };
157
- }
158
- }
159
- observability?.onAccepted?.(request, choice);
160
- if (choice === APPROVAL.ACCEPT_ALL) {
161
- approval.onAcceptAll();
162
- }
163
- approvalSummaries = appendApprovalSummary(approvalSummaries, choice);
164
- }
165
- else if (decision === 'deny') {
166
- observability?.onRejected?.(request);
167
- try {
168
- await postControl({ control: CONTROL.REVERT, cfTxId });
169
- observability?.onReverted?.(request);
170
- return { outcome: 'reverted' };
171
- }
172
- catch {
173
- if (cfTxId != null) {
174
- await postControl({ control: CONTROL.CLEANUP, cfTxId }).catch(() => { });
175
- }
176
- observability?.onRevertFailed?.(request);
177
- return { outcome: 'revert-failed' };
178
- }
94
+ async function requestWriteApproval(approval, ctx, description, observability) {
95
+ const request = {
96
+ kind: 'execute_code',
97
+ title: 'Review Excel changes',
98
+ choices: [APPROVAL.ACCEPT, APPROVAL.ACCEPT_ALL, APPROVAL.REJECT],
99
+ payload: {
100
+ kind: 'write',
101
+ description: description?.trim() || 'Updating Excel'
179
102
  }
103
+ };
104
+ const decision = resolveApprovalExecutionDecision({
105
+ surface: getApprovalSurface(ctx),
106
+ gateAvailable: approval !== undefined,
107
+ isSafe: false,
108
+ isAutoApproved: approval?.isAutoApproved() ?? false,
109
+ alwaysRequireExplicitApproval: false,
110
+ allowHeadlessApproval: ctx?.permissionPolicy?.office.allowHeadlessApproval ?? false
111
+ });
112
+ if (decision === 'allow') {
113
+ return { choice: APPROVAL.ACCEPT, unavailable: false, prompted: false };
180
114
  }
181
- // Accepted (explicitly or auto) — clean up CF highlights.
182
- if (cfTxId != null) {
183
- await postControl({ control: CONTROL.CLEANUP, cfTxId }).catch((e) => {
184
- const msg = e instanceof Error ? e.message : String(e);
185
- log.error('excel-exec', `CF cleanup failed for tx ${cfTxId}: ${msg}`);
186
- });
115
+ if (decision === 'deny' || !approval || !ctx) {
116
+ observability?.onRejected?.(request);
117
+ return { choice: APPROVAL.REJECT, unavailable: true, prompted: false };
118
+ }
119
+ observability?.onRequested?.(request);
120
+ const choice = await approval.requestApproval(request, ctx);
121
+ if (choice === APPROVAL.REJECT || choice === undefined) {
122
+ observability?.onRejected?.(request);
123
+ return { choice, unavailable: false, prompted: true };
187
124
  }
188
- return { outcome: 'accepted', approvalSummaries };
125
+ observability?.onAccepted?.(request, choice);
126
+ return { choice, unavailable: false, prompted: true };
189
127
  }
190
128
  // ---------------------------------------------------------------------------
191
129
  // Core executor
@@ -200,7 +138,7 @@ export async function executeComLocally(excelTarget, code, options) {
200
138
  const resolvedExcelHttpUrl = excelTarget.url;
201
139
  const { approval, ctx, description, signal, observability, editModeTiming } = options ?? {};
202
140
  let approvalSummaries;
203
- const postControl = (body, sig) => xllFetch(`${resolvedExcelHttpUrl}/exec`, {
141
+ const postExec = (body, sig) => xllFetch(`${resolvedExcelHttpUrl}/exec`, {
204
142
  method: 'POST',
205
143
  headers: { 'Content-Type': 'application/json' },
206
144
  body: JSON.stringify(body),
@@ -224,7 +162,7 @@ export async function executeComLocally(excelTarget, code, options) {
224
162
  const sendExecRequest = async () => {
225
163
  let response;
226
164
  try {
227
- response = await postControl({ code, autoApprove }, signal);
165
+ response = await postExec({ code, autoApprove: true }, signal);
228
166
  }
229
167
  catch (e) {
230
168
  if (signal?.aborted || isEditModeAbortError(e)) {
@@ -237,7 +175,6 @@ export async function executeComLocally(excelTarget, code, options) {
237
175
  };
238
176
  // Static analysis: skip approval for code with no detectable writes.
239
177
  const analysis = analyzeComWriteCode(code);
240
- const dangerousLifecycleBypassed = analysis.alwaysRequireApproval && isDangerousExcelLifecycleBypassed(ctx);
241
178
  if (analysis.alwaysRequireApproval) {
242
179
  const approvalResult = await requestAlwaysConfirmApproval(approval, ctx, description, analysis.dangerousOperations, observability);
243
180
  const { choice } = approvalResult;
@@ -257,25 +194,26 @@ export async function executeComLocally(excelTarget, code, options) {
257
194
  }
258
195
  approvalSummaries = appendApprovalSummary(approvalSummaries, choice);
259
196
  }
260
- const autoApprove = analysis.isReadOnly || analysis.alwaysRequireApproval || (approval?.isAutoApproved() ?? false);
261
- const executionDecision = dangerousLifecycleBypassed
262
- ? 'allow'
263
- : resolveApprovalExecutionDecision({
264
- surface: getApprovalSurface(ctx),
265
- gateAvailable: approval !== undefined,
266
- isSafe: analysis.isReadOnly,
267
- isAutoApproved: approval?.isAutoApproved() ?? false,
268
- alwaysRequireExplicitApproval: false,
269
- allowHeadlessApproval: ctx?.permissionPolicy?.office.allowHeadlessApproval ?? false
270
- });
271
- if (executionDecision === 'deny') {
272
- return {
273
- result: {
274
- ok: true,
275
- output: INTERACTIVE_APPROVAL_UNAVAILABLE_MESSAGE
276
- },
277
- outcome: 'approval-unavailable'
278
- };
197
+ else if (!analysis.isReadOnly) {
198
+ const approvalResult = await requestWriteApproval(approval, ctx, description, observability);
199
+ const { choice } = approvalResult;
200
+ if (choice !== APPROVAL.ACCEPT && choice !== APPROVAL.ACCEPT_ALL) {
201
+ return {
202
+ result: {
203
+ ok: true,
204
+ output: approvalResult.unavailable
205
+ ? INTERACTIVE_APPROVAL_UNAVAILABLE_MESSAGE
206
+ : 'Excel operation rejected by user.'
207
+ },
208
+ outcome: approvalResult.unavailable ? 'approval-unavailable' : 'rejected'
209
+ };
210
+ }
211
+ if (approvalResult.prompted && choice === APPROVAL.ACCEPT_ALL) {
212
+ approval?.onAcceptAll();
213
+ }
214
+ if (approvalResult.prompted) {
215
+ approvalSummaries = appendApprovalSummary(approvalSummaries, choice);
216
+ }
279
217
  }
280
218
  let result = await sendExecRequest();
281
219
  if (result.editMode) {
@@ -289,34 +227,6 @@ export async function executeComLocally(excelTarget, code, options) {
289
227
  if (!result.ok) {
290
228
  return { result, outcome: 'failed' };
291
229
  }
292
- if (ctx) {
293
- const { outcome, approvalSummaries: resolvedApprovalSummaries } = await resolveApproval(result, approval, (b) => postControl(b), ctx, description, observability, approvalSummaries);
294
- return { result, outcome, approvalSummaries: resolvedApprovalSummaries };
295
- }
296
- if (result.diff) {
297
- try {
298
- await postControl({ control: CONTROL.REVERT, cfTxId: result.cfTxId });
299
- return {
300
- result: { ...result, output: 'Excel operation rejected by user.' },
301
- outcome: 'reverted'
302
- };
303
- }
304
- catch {
305
- if (result.cfTxId != null) {
306
- await postControl({ control: CONTROL.CLEANUP, cfTxId: result.cfTxId }).catch(() => { });
307
- }
308
- return {
309
- result: { ...result, output: 'Excel operation rejected by user.' },
310
- outcome: 'revert-failed'
311
- };
312
- }
313
- }
314
- if (result.cfTxId != null) {
315
- await postControl({ control: CONTROL.CLEANUP, cfTxId: result.cfTxId }).catch((e) => {
316
- const msg = e instanceof Error ? e.message : String(e);
317
- log.error('excel-exec', `CF cleanup failed for tx ${result.cfTxId}: ${msg}`);
318
- });
319
- }
320
230
  return { result, outcome: 'accepted', approvalSummaries };
321
231
  }
322
232
  //# sourceMappingURL=executor.js.map
@@ -31,26 +31,6 @@ export function createExecuteCodeApprovalObservability(clientLogger) {
31
31
  approval_kind: request.payload.kind
32
32
  }
33
33
  });
34
- },
35
- onReverted: (request) => {
36
- clientLogger.info({
37
- module: 'tool',
38
- event: 'tool_approval_reverted',
39
- data: {
40
- tool_name: TOOL_NAME,
41
- approval_kind: request.payload.kind
42
- }
43
- });
44
- },
45
- onRevertFailed: (request) => {
46
- clientLogger.error({
47
- module: 'tool',
48
- event: 'tool_approval_revert_failed',
49
- data: {
50
- tool_name: TOOL_NAME,
51
- approval_kind: request.payload.kind
52
- }
53
- });
54
34
  }
55
35
  };
56
36
  }
@@ -81,23 +81,6 @@ export function createExcelExecTool(resolveTarget, approval, observability) {
81
81
  ctx: ctx,
82
82
  signal: signal ?? undefined
83
83
  });
84
- if (outcome === 'revert-failed') {
85
- return {
86
- content: [
87
- {
88
- type: 'text',
89
- text: 'Revert failed — changes are still applied in Excel. You may need to undo manually (Ctrl+Z).'
90
- }
91
- ],
92
- details: result
93
- };
94
- }
95
- if (outcome === 'reverted') {
96
- return {
97
- content: [{ type: 'text', text: 'Changes reverted by user.' }],
98
- details: result
99
- };
100
- }
101
84
  if (outcome === 'rejected') {
102
85
  return {
103
86
  content: [{ type: 'text', text: USER_REJECTED_APPROVAL_MESSAGE }],
@@ -47,8 +47,10 @@ const RAW_COM_WRITES = [
47
47
  /\.ClearComments\s*\(/,
48
48
  /\.ClearNotes\s*\(/,
49
49
  /\.Copy\s*\(/,
50
+ /\.Cut\s*\(/,
50
51
  /\.PasteSpecial\s*\(/,
51
52
  /\.AutoFill\s*\(/,
53
+ /\.Resize\s*\(/,
52
54
  /\.Merge\s*\(/,
53
55
  /\.UnMerge\s*\(/,
54
56
  /\.Move\s*\(/,
@@ -13,6 +13,7 @@ async function captureComScreenshot(host, range, signal) {
13
13
  headers: { 'Content-Type': 'application/json' },
14
14
  body: JSON.stringify({
15
15
  control: 'screenshot',
16
+ workbook: range.workbook,
16
17
  sheet: range.sheet,
17
18
  range: range.cell_range
18
19
  }),
@@ -43,6 +44,7 @@ export async function captureComScreenshots(ranges, signal, resolveTarget) {
43
44
  const msg = error instanceof Error ? error.message : String(error);
44
45
  console.error(`[take_screenshot] COM capture unavailable: ${msg}`);
45
46
  return ranges.map((range) => ({
47
+ workbook: range.workbook,
46
48
  sheet: range.sheet,
47
49
  cell_range: range.cell_range,
48
50
  data: null
@@ -58,7 +60,12 @@ export async function captureComScreenshots(ranges, signal, resolveTarget) {
58
60
  const msg = error instanceof Error ? error.message : String(error);
59
61
  console.error(`[take_screenshot] COM capture failed for ${range.sheet}!${range.cell_range}: ${msg}`);
60
62
  }
61
- screenshots.push({ sheet: range.sheet, cell_range: range.cell_range, data });
63
+ screenshots.push({
64
+ workbook: range.workbook,
65
+ sheet: range.sheet,
66
+ cell_range: range.cell_range,
67
+ data
68
+ });
62
69
  }
63
70
  return screenshots;
64
71
  }
@@ -1,6 +1,5 @@
1
1
  import type { Screenshot, ScreenshotRange } from '../../../tools/take-screenshot.js';
2
2
  interface MogSheetPoolWithScreenshots {
3
- activeWorkbookName: string | null | undefined;
4
3
  getWorkbook(name: string): unknown;
5
4
  }
6
5
  export declare function captureMogScreenshots(pool: MogSheetPoolWithScreenshots, ranges: ScreenshotRange[], _signal?: AbortSignal): Promise<Screenshot[]>;
@@ -4,26 +4,14 @@ function isMogWorkbookWithScreenshots(value) {
4
4
  typeof value.captureScreenshot === 'function');
5
5
  }
6
6
  export async function captureMogScreenshots(pool, ranges, _signal) {
7
- if (!pool.activeWorkbookName) {
8
- return ranges.map((range) => ({
9
- sheet: range.sheet,
10
- cell_range: range.cell_range,
11
- data: null
12
- }));
13
- }
14
- const workbook = pool.getWorkbook(pool.activeWorkbookName);
15
- if (!isMogWorkbookWithScreenshots(workbook)) {
16
- console.error('[take_screenshot] Active Mog workbook does not support screenshot capture');
17
- return ranges.map((range) => ({
18
- sheet: range.sheet,
19
- cell_range: range.cell_range,
20
- data: null
21
- }));
22
- }
23
7
  const screenshots = [];
24
8
  for (const range of ranges) {
25
9
  let data = null;
26
10
  try {
11
+ const workbook = pool.getWorkbook(range.workbook);
12
+ if (!isMogWorkbookWithScreenshots(workbook)) {
13
+ throw new Error(`Workbook does not support screenshot capture: ${range.workbook}`);
14
+ }
27
15
  const pngBuffer = await workbook.captureScreenshot(range.sheet, range.cell_range);
28
16
  data = Buffer.from(pngBuffer).toString('base64');
29
17
  }
@@ -31,7 +19,12 @@ export async function captureMogScreenshots(pool, ranges, _signal) {
31
19
  const msg = error instanceof Error ? error.message : String(error);
32
20
  console.error(`[take_screenshot] Mog capture failed for ${range.sheet}!${range.cell_range}: ${msg}`);
33
21
  }
34
- screenshots.push({ sheet: range.sheet, cell_range: range.cell_range, data });
22
+ screenshots.push({
23
+ workbook: range.workbook,
24
+ sheet: range.sheet,
25
+ cell_range: range.cell_range,
26
+ data
27
+ });
35
28
  }
36
29
  return screenshots;
37
30
  }
@@ -65,7 +65,7 @@ Launch verification subagent(s) in the background to check results against requi
65
65
 
66
66
  - **NEVER** write "based on your findings, implement X" — this pushes synthesis onto the subagent. YOU must synthesize research results and write precise instructions.
67
67
  - **NEVER** delegate understanding. Read subagent outputs, extract what matters, then write specific implementation instructions.
68
- - **NEVER** launch a single subagent for a task that could be parallelized. If 5 sheets need independent work, launch 5 subagents.
68
+ - **NEVER** spawn a replacement until the original subagent has stopped, and never resume the original afterward.
69
69
  - **NEVER** give vague instructions like "fix the formatting" — specify which cells, which format, which style.
70
70
 
71
71
  ## Delegation Format
@@ -59,6 +59,7 @@ function getDefaultModelCandidatesForProvider(provider) {
59
59
  if (provider === SHORTCUT_PROVIDER_ID) {
60
60
  return [
61
61
  SHORTCUT_OPENAI_MODEL_ID,
62
+ SHORTCUT_MODEL_ID.ClaudeFable51,
62
63
  SHORTCUT_MODEL_ID.ClaudeFable5,
63
64
  SHORTCUT_MODEL_ID.ClaudeOpus5
64
65
  ];
@@ -34,7 +34,7 @@ export const ALL_THINKING_LEVELS = [
34
34
  /** Models shown in interactive model controls for known providers. Unlisted providers show all. */
35
35
  const INTERACTIVE_MODELS_PER_PROVIDER = {
36
36
  shortcut: new Set([
37
- SHORTCUT_MODEL_ID.ClaudeFable5,
37
+ SHORTCUT_MODEL_ID.ClaudeFable51,
38
38
  SHORTCUT_MODEL_ID.ClaudeOpus5,
39
39
  SHORTCUT_OPENAI_MODEL_ID,
40
40
  SHORTCUT_MODEL_ID.Gpt56Luna,
@@ -18,10 +18,12 @@
18
18
  import type { ToolDefinition } from '../../core/core-types.js';
19
19
  import { type ShortcutLlmProxyClient } from '../providers/shortcut-llm-proxy-client.js';
20
20
  export interface ScreenshotRange {
21
+ workbook: string;
21
22
  sheet: string;
22
23
  cell_range: string;
23
24
  }
24
25
  export interface Screenshot {
26
+ workbook: string;
25
27
  sheet: string;
26
28
  cell_range: string;
27
29
  /** Base64-encoded PNG data. Null/undefined means capture failed for this range. */
@@ -49,6 +51,7 @@ export interface TakeScreenshotOperations {
49
51
  }
50
52
  declare const schema: import("@sinclair/typebox").TObject<{
51
53
  ranges: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
54
+ workbook: import("@sinclair/typebox").TString;
52
55
  sheet: import("@sinclair/typebox").TString;
53
56
  cell_range: import("@sinclair/typebox").TString;
54
57
  }>>;
@@ -33,6 +33,9 @@ const DESCRIPTION = TAKE_SCREENSHOT_TOOL_DESCRIPTION;
33
33
  // Schema
34
34
  // ---------------------------------------------------------------------------
35
35
  const RangeSchema = Type.Object({
36
+ workbook: Type.String({
37
+ description: 'Exact workbook name to capture, such as "Model.xlsx". Use the name only, not a path.'
38
+ }),
36
39
  sheet: Type.String({ description: 'Sheet name to capture.' }),
37
40
  cell_range: Type.String({ description: 'Range to capture, e.g. "A1:G10".' })
38
41
  });
@@ -135,7 +138,7 @@ export function createTakeScreenshotTool(operations = defaultOperations) {
135
138
  // Filter to valid screenshots (those with data)
136
139
  const validScreenshots = screenshots.filter((ss) => ss.data);
137
140
  if (validScreenshots.length === 0) {
138
- const rangesStr = ranges.map((r) => `${r.sheet}!${r.cell_range}`).join(', ');
141
+ const rangesStr = ranges.map((r) => `${r.workbook}:${r.sheet}!${r.cell_range}`).join(', ');
139
142
  return {
140
143
  content: [
141
144
  {
@@ -151,7 +154,7 @@ export function createTakeScreenshotTool(operations = defaultOperations) {
151
154
  try {
152
155
  const result = await operations.analyzeWithVisionLLM(validScreenshots, query, selectedModel, extCtx.shortcutLlmProxy, signal ?? undefined);
153
156
  const rangesSummary = validScreenshots
154
- .map((ss) => `${ss.sheet}!${ss.cell_range}`)
157
+ .map((ss) => `${ss.workbook}:${ss.sheet}!${ss.cell_range}`)
155
158
  .join(', ');
156
159
  return {
157
160
  content: [{ type: 'text', text: result.text }],